It is self evident from the above table 6-3 that cloud computing not only expands the scope of
security but also brings new security risks.
6.5.1
Safeguard Security in the Cloud Environment
How to construct a controllable and secure platform for cloud service applications? From
security prospective, the traditional information security governance concepts can still be
referenced. The security requirements of the different applications in different industry
should be considered up front, using a multi-pronged approach to resolve security issues,
including evaluation and control of areas such as technology, standards, regulation, and
legal, etc. Since the security objectives vary by the types of industry and applications, the
corresponding strategies for risk management are not the same, so a case-by-case style of
security control needs to be considered. For example, the financial industry has higher
information security requirements for transactions and client information. Cloud computing
will bring in higher challenges in the management of information leakage and privacy.
The main risks include:
1.
The uncontrolled ability to spread
.
Via cloud, information is shared on the platforms, which increases the risk of
spreading the information uncontrollably. For example, competitors, individual related
to the information, or people interested in the information can spread or leak security
information intentionally or un-intentionally.
2.
Increased mobility of information makes cross-border judicial difficult to apply
.
In the cloud, the rapid data flow allowing the data to be stored in a distributed
environment in different locations. This will bring in different legal and privacy
protection requirements depending on the country and geographical location (e.g.,
EU privacy protection rules).
3.
Centralization poses greater risks.
In public cloud, the service providers have the permission for data processing and
data storage; this can also increase the risk of information leakage either accidentally
or intentionally.
4.
Privacy protection is more difficult.
Since enterprises outsource private information, such as the information of clients,
employees, and collaborating enterprises; the possibility of information leakage
increases.
